Exchange online setup defender

Exchange Online includes baseline anti-spam and anti-malware filtering, while Microsoft Defender for Office 365 Plan 1 or Plan 2 is a separate license that you assign and then configure in the Microsoft 365 Defender portal. Verify the result with policy tests and message trace. Misconfigured settings can leave phishing and malware paths open or block mail that should flow, which wastes time and creates cleanup work. This guide maps the licensing choice, setup locations, and verification steps for Exchange Online.

What you need first

• An assigned Microsoft 365 admin role that can edit security and mail flow policies.
• A license check for each mailbox user, including Exchange Online Plan 1, Exchange Online Plan 2, or a Microsoft 365 Business plan with the security add-on you intend to use.
• Access to the Microsoft 365 Defender portal at https://security.microsoft.com.
• Access to the Exchange admin center at https://admin.exchange.microsoft.com.
• A list of current mail flow rules, third-party gateways, and any external sender notices already in use.
• A test mailbox or pilot group for policy assignment before broad rollout.

Exchange Online security baseline

Exchange Online Protection is the base email security layer. It includes anti-spam filtering, anti-malware filtering, mailbox protection, and quarantine controls. Microsoft Defender for Office 365 commonly adds advanced anti-phishing controls, Safe Links, and Safe Attachments. Licensing decides which of those controls are available in the plan or as an add-on.

What Exchange Online Protection already includes

Exchange Online Plan 1 includes built-in anti-malware and anti-spam filtering, a 99.9% uptime SLA, and an in-place archive. It is hosted email for business and is managed through a web-based Exchange admin center. Microsoft also states that Exchange Online provides anywhere access to email, calendar, and contacts.

What Microsoft Defender for Office 365 adds

Defender for Office 365 adds time-of-click link checks through Safe Links, malware detonation and scanning through Safe Attachments, and advanced anti-phishing controls. Those features sit on top of Exchange Online Protection, not in place of it. Spoof intelligence and quarantine remain part of the baseline security layer and should be checked during setup.

Which plan covers which feature?

Exchange Online Plan 1 can be paired with Defender add-ons when the tenant is licensed for them. Microsoft 365 Business plans can include ATP or qualify for a security add-on, depending on the exact subscription. The setup path stays the same; the license gate changes what appears in the portal.

Where do you enable Defender?

Use the Microsoft 365 Defender portal for security policies and the Exchange admin center for mail flow rules and policy control. Defender policies are not enabled in one place only. Policy scope, Safe Links behavior, attachment actions, and anti-phishing controls are typically managed in Microsoft 365 security, while transport rules and mail flow exceptions are typically managed in Exchange admin.

Use the Microsoft 365 Defender portal

Open https://security.microsoft.com, then go to the email and collaboration policies area. That is where Safe Links, Safe Attachments, anti-phishing, spoof intelligence review, and quarantine policy settings are created or edited. The current product naming is Microsoft Defender for Office 365.

Use the Exchange admin center

Open https://admin.exchange.microsoft.com, then inspect mail flow rules, connectors, and anti-spam policy settings that may override or redirect message handling. If a transport rule stamps banners, rewrites addresses, or bypasses filtering, Defender results can look inconsistent even when the policy is healthy.

How do I set up Microsoft Defender for Exchange Online?

Start with licensing, then create the security policies in Microsoft 365 Defender, and only then test with a narrow user group. That order keeps mail flow stable. The safest rollout is pilot first, broad scope second, because policy precedence and transport rules can affect delivery before users see the new protection.

1. Assign the correct license to the pilot mailbox users in Microsoft 365 admin center or the licensing page you use for your tenant.
2. Open https://security.microsoft.com and create the anti-phishing policy, or edit an existing one if you already have a baseline policy.
3. Enable spoof intelligence review and quarantine actions where available.
4. Create a Safe Links policy and a Safe Attachments policy.
5. Scope each policy to a pilot group or test domain first.
6. Save the policy and allow about 15 to 60 minutes for it to apply before testing.
7. Confirm results with message trace, policy hit details, and quarantine entries.

Say your tenant already uses an external gateway that rewrites URLs. Safe Links may not match the original link if that gateway changes the message before Microsoft processes it. In that case, fix the gateway exception or path first, then retest the Defender policy.

Enable Safe Links and Safe Attachments

Safe Links checks links at click time, which makes it useful for phishing defense even when the original message looked clean. Safe Attachments scans or detonates attachments before delivery or during delivery, depending on the action you choose. Set both in Microsoft 365 Defender, then verify the user scope and policy priority.

Turn on Safe Links

1. Go to Microsoft 365 Defender > Email & collaboration > Policies & rules > Threat policies > Safe Links.
2. Create a policy or edit an existing one.
3. Enable link protection for email and, if licensed, Office apps.
4. Apply the policy to the intended users or domains by selecting the specific pilot group, user list, or test domain you want protected.
5. Save, then send a test message with a known URL and click it from a mailbox in scope.

After enablement, users should see rewritten or checked links and blocking or warning behavior when a destination is judged unsafe at click time. That is the user-visible result to expect.

Turn on Safe Attachments

1. Go to Microsoft 365 Defender > Email & collaboration > Policies & rules > Threat policies > Safe Attachments.
2. Create a policy or edit an existing one.
3. Choose Dynamic delivery for continuity when users need the message body immediately, or choose Block when you want the strictest stop-first posture.
4. Assign the policy to the right users or groups, such as the pilot group you created for validation.
5. Save and confirm that the policy status shows as active.

Dynamic delivery fits most business mailboxes because it keeps mail moving while the attachment is scanned. Block fits tighter security requirements, high-risk groups, or staged pilots where any suspicious attachment should stop until cleared.

Is Exchange Online Protection enough, or do I need Defender?

Exchange Online Protection is enough for baseline filtering, quarantine, and anti-malware or anti-spam coverage. Add Defender when you need time-of-click link checks, advanced attachment handling, and stronger anti-phishing controls. If your users receive external mail all day, Defender is usually the better fit for reducing phishing risk.

Exchange Online Plan 1 at $4.00 per user/month, paid yearly gives the base hosted email service. Exchange Online Plan 2 adds enterprise email hosting and more archive-related capability. The advanced threat protection layer is separate from that base mail service, so do not assume every mailbox has it by default. (Microsoft)

Exchange Online setup matrix

This matrix shows the exact setup path for the main protections. Use it to confirm what is already included, what needs a license, where it is configured, what success looks like, and what failure clue to check first.

How do you verify mail flow?

Confirm protection in three places: message trace, policy hit details, and quarantine. Give policy changes 15 to 60 minutes before retesting, then send a controlled test message. If results are mixed, check whether a transport rule, connector, or third-party gateway is changing the message before Defender evaluates it.

Check message headers and policy hits

1. Open message trace in the Exchange admin center.
2. Review the message details for the policy that processed it.
3. Open the message headers and look for the applied anti-spam, anti-phishing, or Safe Links result fields.
4. Compare the header result with the policy you assigned in Microsoft 365 Defender.

Check quarantine and reports

1. Open the quarantine view in Microsoft 365 Defender.
2. Confirm the message appears with the expected reason and action.
3. Open the threat explorer or related email report view if the license includes it.
4. Match the report entry to the user, sender, and policy scope.

License not assigned means the mailbox user does not have the subscription needed for the policy to apply. Policy scope too narrow means the mailbox or group was left out, or was excluded, so the policy cannot act on that user.

Suppose a protected user still receives a phishing link without any rewrite or block. That usually points to one narrow issue: the policy does not include that user, or a transport rule is taking precedence before the Defender policy can act.

Common mistakes

Most setup problems come from scope, precedence, or licensing. Fix those first. If the mailbox is not licensed, the policy may exist but never apply. If a transport rule or external gateway changes the mail first, the Defender action may not show up where you expect it.

1. License not assigned: verify the user has the right Exchange Online or Defender-enabled subscription.
2. Policy scope too narrow: confirm the mailbox or group is included, not excluded.
3. Transport rule conflict: review Exchange admin center mail flow rules for bypass or rewriting.
4. Gateway conflict: check third-party spam filters, URL rewriting, and attachment handling outside Microsoft.
5. Wrong attachment action: change from Block to Dynamic delivery if the business needs immediate mail flow while scanning continues.

Prevention: keep one pilot group and one production group, then move changes in that order. That limits surprise mail changes and makes policy precedence easier to trace.

Frequently asked questions

What’s the difference between Exchange Online Protection and Defender for Office 365?

EOP is the built-in security layer that filters spam and malware and handles quarantine and spoof signals. Defender for Office 365 adds Safe Links, Safe Attachments, and advanced anti-phishing controls. In practice, EOP filters the obvious threats, while Defender adds extra inspection and user protection.

How do I enable Safe Links and Safe Attachments for Exchange Online?

Go to Microsoft 365 Defender > Email & collaboration > Policies & rules > Threat policies, then create or edit the Safe Links and Safe Attachments policies. Assign them to the correct users or domains, choose Dynamic delivery or Block for attachments, and confirm the policy status after saving.

Which Exchange Online plans include advanced threat protection?

Exchange Online Plan 1 includes the base mail service, built-in filtering, archive, and uptime SLA, but advanced threat protection is separate. Exchange Online Plan 2 adds more security and archive-related capability. Microsoft 365 Business plans may include ATP or qualify for a security add-on, depending on the subscription.

Where do I configure spoof intelligence and quarantine policies?

Review and manage them in the Microsoft 365 Defender portal, not as Defender-only extras. Spoof intelligence and quarantine are part of the baseline Exchange Online Protection layer, so the relevant policy page should show them alongside the other email threat settings. Confirm the assigned scope before calling setup complete.